Causal relation graph generation device, and causal relation graph generation method

Abstract

To provide a causal relation graph generation device capable of easily creating a causal relation graph having high comprehensiveness.SOLUTION: A relevant element extraction unit 13 specifies a relevant element being an element exerting an influence on a detection parameter among elements on a data flow on the basis of a detection parameter being data to be used for detecting an incident occurring in a system, and the data flow indicating a flow of data used in the system. A graph generation unit 14 specifies a relevant event being an event causing an incident on the basis of the relevant element specified by the relevant element extraction unit 13 and system information, and generates a causal relation graph on the basis of the relevant event.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to a causal relationship graph generation device and a causal relationship graph generation method.

Background Art

[0002] As a method for describing the causes of incidents such as failures and attacks that occur in a system such as a computer system, a method of decomposing events using a tree-structured graph called a fault tree or an attack tree is known. A causal relationship graph, which is this type of tree structure, is useful for analyzing the causes of incidents. However, since the causes of incidents that occur in a system are diverse, a large amount of man-hours is required to create a causal relationship graph manually.

[0003] On the other hand, Patent Document 1 discloses a technique for generating an attack tree corresponding to a system by decomposing the system, selecting one or more subsystems located on the intrusion path of a threat to a root system that is one of a plurality of subsystems, and combining sub-attack trees corresponding to each of the selected subsystems.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] In a causal relationship graph, it is desired to comprehensively describe the causes of an incident. However, in the technique described in Patent Document 1, the comprehensiveness of the causes in the attack tree depends on the method of configuring the sub-attack trees. Therefore, depending on the configuration method, sufficient comprehensiveness cannot be ensured, and there is a high risk of overlooking the causes of the incident.

[0006] An object of the present disclosure is to provide a causal relationship graph generation device and a causal relationship graph generation method capable of easily creating a comprehensive causal relationship graph.

Means for Solving the Problems

[0007] A causal relationship graph generation device according to an aspect of the present disclosure is a causal relationship graph generation device that generates a causal relationship graph describing related events that are events causing an incident occurring in a system, and is based on a detection parameter that is data used for detecting the occurrence of the incident and a data flow indicating a data flow used in the system. Among the elements on the data flow, a specifying unit that specifies related elements that are elements affecting the detection parameter, and based on the related elements and system information indicating the configuration of the system, specifies the related events, and based on the related events, A graph generation unit that generates the causal relationship graph.

Effects of the Invention

[0008] According to the present invention, it becomes possible to easily create a comprehensive causal relationship graph.

Brief Description of the Drawings

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Mode for Carrying Out the Invention

[0010] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0011] FIG. 1 is a diagram showing a functional configuration of a causal relationship graph generation device according to an embodiment of the present disclosure. The causal relationship graph generation device 1 shown in FIG. 1 is a device for generating a causal relationship graph that describes related events that are events causing incidents such as failures and attacks occurring in a system such as a computer system. The causal relationship graph generation device 1 is realized, for example, by an information processing device including a processor (computer) and a memory (both not shown). In this case, each configuration and each function of the causal relationship graph generation device 1 described below are realized, for example, when the processor reads a computer program and executes the read computer program.

[0012] The causal relationship graph generation device 1 functionally includes an input / output unit 10, a storage unit 11, a data flow independent part generation unit 12, a related element extraction unit 13, and a graph generation unit 14.

[0013] The input / output unit 10 receives various information for generating a causal relationship graph from a user who uses the causal relationship graph generation device 1 or an external device such as a terminal device used by the user, and also outputs (for example, displays) the causal relationship graph and various information for generating the causal relationship graph.

[0014] In the present embodiment, the input / output unit 10 receives, as input data, an incident list that shows detection parameters used for the system to detect an incident that is the target of the causal relationship graph for each incident, a data flow list that is a list of data flows showing the flow of data used in the system, and system information showing the configuration of the system. Further, the input / output unit 10 displays an input screen for the user to input the input data and the causal relationship graph.

[0015] The storage unit 11 stores various information for generating a causal relationship graph. In the present embodiment, the storage unit 11 stores a decomposition template DB (Data Base) 111 and a data flow related event template DB 112. The decomposition template DB 111 shows a decomposition template that is a template related to the data flow independent part, which is the part of the causal relationship graph that does not depend on the data flow of the detection parameters. The data flow related event template DB 112 shows an event template that is a template related to the data flow dependent part, which is the part of the causal relationship graph that depends on the data flow of the detection parameters.

[0016] The data flow independent part generation unit 12 is an independent part generation unit that generates a data flow independent part, which is a part of the causal relationship graph that does not depend on the data flow, based on the incident list received by the input / output unit 10 and the decomposition template DB 111 stored in the storage unit 11.

[0017] The related element extraction unit 13 is a specifying unit that specifies related elements, which are elements on the data flow that affect the detection parameters, based on the detection parameters included in the incident list received by the input / output unit 10 and the data flow list received by the input / output unit 10. In this embodiment, the elements on the data flow include the functions of the system and the data used in the system.

[0018] The graph generation unit 14 generates a dependent part that depends on the data flow in the causal graph based on the related elements specified by the related element extraction unit 13, the system information received by the input / output unit 10, and the data flow related event template DB 112 stored in the storage unit 11. Then, the graph generation unit 14 generates a causal graph based on the generated dependent part of the causal graph and the data flow independent part of the causal graph generated by the data flow independent part generation unit 12.

[0019] Figures 2 to 4 are diagrams showing an example of the input data received by the input / output unit 10.

[0020] Specifically, Figure 2 is a diagram showing an example of an incident list. The incident list 200 shown in Figure 2 includes fields 201 to 203.

[0021] Field 201 stores the incident name, which is the name of the incident, as identification information for identifying the incident. Field 202 stores the incident type indicating the type of the incident. The incident type may further indicate whether the detection parameters for detecting the incident are singular or plural. For example, when the detection parameter is singular, the incident type indicates "single type (such as functional safety)", and when the detection parameter is plural, the incident type indicates "comparison type". Note that the case where there are multiple detection parameters is, for example, the case where the incident is detected by comparing those detection parameters. Also, field 203 is provided for each detection parameter used for detecting the incident.

[0022] FIG. 3 is a diagram showing an example of a data flow list. The data flow list 300 shown in FIG. 3 includes fields 301 to 306.

[0023] Field 301 stores the source type, which is the type of the element at the source of the data flow. The types of elements include system functions and data used in the system. Field 302 stores the source element name, which is the name of the element at the source as identification information for identifying the element at the source. Field 303 stores the source component name, which is the name of the component of the system corresponding to the element at the source, as identification information for identifying the component of the system corresponding to the element at the source. Specifically, a component is a device that constitutes the system. The component corresponding to an element is the component having that function when the type of the element is a function, and is the component that generates that data when the type of the element is data.

[0024] Field 304 stores the destination type, which is the type of the element at the destination of the data flow. Field 305 stores the destination element name, which is the name of the element at the destination as identification information for identifying the element at the destination. Field 306 stores the destination component name, which is the name of the component corresponding to the element at the destination.

[0025] Note that in the example of FIG. 3, the data flow list 300 omits data other than data that may be detection parameters in the data flow, but these data do not necessarily have to be omitted.

[0026] FIG. 4 is a diagram showing an example of system information. The system information 400 shown in FIG. 4 includes fields 401 to 406.

[0027] Field 401 stores the component name, which is the name of the component. Field 402 stores the layer name as identification information for identifying the layer on the system implemented by the component. Note that one component may implement multiple layers. The layer indicates, for example, hardware (HW: Hardware), OS (Operation System), function, and data. Field 403 stores the element name of the element when the layer is an element (function or data) on the data flow. Fields 404 to 406 store properties indicating the nature of the layer. Examples of the properties include command acceptability indicating whether a command can be accepted, GUI operation possibility indicating whether an operation from the GUI (Graphical User Interface) is possible, and update possibility indicating whether an update is possible. In the example of FIG. 4, Field 404 stores the command acceptability, Field 405 stores the GUI operation possibility, and Field 406 stores the update possibility. Also, these properties indicate "1" if possible and "0" if not possible. Note that the properties shown in FIG. 4 are merely examples and are not limited thereto.

[0028] FIGS. 5 and 6 are diagrams showing an example of the registered data stored in the storage unit 11.

[0029] FIG. 5 is a diagram showing an example of the decomposition template DB111. The decomposition template DB111 shown in FIG. 5 includes fields 501 to 505.

[0030] Field 501 stores the incident type of an incident. The incident type in Field 501 is used to link to the incident that is the target of the causal relationship graph shown in the incident list, as will be described later. Field 502 stores the graph type, which is the type of the causal relationship graph of the incident of the incident type in Field 501. In this embodiment, the graph type indicates a failure (fault tree) or an attack (attack tree), but is not limited to this example. For example, the graph type may indicate an operation error or the like.

[0031] Fields 503 to 505 store a decomposition template, which is a template regarding the data flow-independent part in the causal relationship graph. Fields 503 to 505 are provided for each node in the data flow-independent part in the causal relationship graph, and are arranged in order from the upper node to the lower node from the left in the same record.

[0032] Field 503 stores logic gate information indicating a logic gate that defines the connection relationship between a target node and its upper-level node. When there are multiple lower-level nodes connected to the upper-level node, the logic gate information indicates OR (logical sum) or AND (logical product) as the logic gate connecting those nodes. When there is a single lower-level node, it indicates nothing (-). Field 504 stores a node template that is a template for the target node. The node template includes an event corresponding to the node and an insertion part for inserting detection parameters used to detect the event corresponding to the node. The event corresponding to the node indicates, for example, "parameter abnormality occurs due to an attack" or "attempt to bypass functional safety". Also, in the example of FIG. 5, the insertion part is indicated by [detection parameter 1] and [detection parameter 2], etc. Field 505 stores deployment necessity information indicating whether to deploy the target node based on the data flow. In the example of the figure, the deployment necessity information indicates "Yes" when the target node is to be deployed based on the data flow, and "No" when it is not to be deployed based on the data flow of the target node. In this embodiment, the node to be deployed based on the data flow is the lowest-level node in the data flow-independent part. When there is a node in the data flow-independent part below the target node, the deployment necessity information indicates "-".

[0033] FIG. 6 is a diagram showing an example of the data flow-related event template DB112. The data flow-related event template DB112 shown in FIG. 6 includes fields 601 to 605.

[0034] Field 601 stores an ID as identification information for identifying an event template that is a template for nodes corresponding to events occurring for each element of the data flow. Field 602 stores the graph type of the causal relationship graph corresponding to the event template. Field 603 stores the event template. The event template has an event including an insertion part for inserting components and functions related to the event. Field 604 stores the layer name of the layer where the event of the event template occurs. Field 605 stores the occurrence condition for the event of the event template. In this embodiment, the occurrence condition indicates the property of the layer where the event of the event template occurs.

[0035] FIG. 7 is a diagram showing an example of an input screen for a user to input input data. The input screen 700 shown in FIG. 7 includes input fields 701 to 703 for inputting an incident list, a data flow list, and system information, respectively, a confirmation button 704, and a cancel button 705. The confirmation button 704 is a button for confirming the data input in the input fields 701 to 703, and the cancel button 705 is a button for canceling the data input in the input fields 701 to 703.

[0036] Note that the input screen 700 shown in FIG. 7 is merely an example and is not limited to this example. For example, the input screen may have a UI (User Interface) that can create a data flow in a graph format.

[0037] FIG. 8 is a flowchart for explaining an example of the operation of the causal relationship graph generation device 1, and FIG. 9 is a sequence chart for explaining an example of the operation of the causal relationship graph generation device 1.

[0038] First, as shown in FIGS. 8 and 9, the input / output unit 10 of the causal relationship graph generation device 1 acquires an incident list, a data flow list, and system information, which are input data from a user. The input / output unit 10 outputs the incident list to the data flow independent part generation unit 12, outputs the data flow list to the related element extraction unit 13, and outputs the system information to the graph generation unit 14 (step S101).

[0039] For each incident name included in the incident list from the input / output unit 10, the data flow independent part generation unit 12 acquires a decomposition template corresponding to the target incident that is the incident of the incident name (step S102). Specifically, the data flow independent part generation unit 12 acquires a decomposition template corresponding to the incident type of the target incident from the decomposition template DB111. Hereinafter, it is assumed that there is only one target incident. When there are a plurality of target incidents, the following processing is performed for each target incident.

[0040] Based on the acquired decomposition template, the data flow independent part generation unit 12 generates the data flow independent part of the causal relationship graph of the target incident, and outputs the data flow independent part to the related element extraction unit 13 (step S103).

[0041] FIG. 10 is a diagram for explaining an example of the process of generating the data flow independent part. As shown in FIG. 10, the data flow independent part generation unit 12 sets the node indicating the target incident as the topmost node, and according to the acquired decomposition template, substitutes the value of the detection parameter of the incident list into the insertion part of each node template in the field 504 to generate each node 1001, and connects each node with the logic gate indicated by the logic gate information in the field 503, thereby generating the data flow independent part 1000 of the causal relationship graph. In FIG. 10, among each node 1001, a mesh is drawn on the expansion target node 1002, which is a node expanded based on the data flow.

[0042] Return to the description of the operation. For each node to be expanded, a loop process A that repeats the processes of steps S105 to S110 is started in the related element extraction unit 13 and the graph generation unit 14 (step S104).

[0043] In the loop process A, first, the related element extraction unit 13 refers to the data flow list and obtains a list of related elements that are elements on the data flow and affect the detection parameters included in the node to be expanded. The related element extraction unit 13 outputs the data flow non-dependent part of the causal relationship graph and the list of related elements to the graph generation unit 14 (step S105).

[0044] FIG. 11 is a diagram for explaining an example of the process of obtaining a list of related elements. As shown in FIG. 11, the related element extraction unit 13 identifies data that becomes the detection parameter "engine stop command issuance history" included in the node to be expanded from the data flow list. Then, the related element extraction unit 13 identifies, as the top element of the identified data, all elements lower than the top element by tracing the elements from the top element to the source of the flow as related elements, and obtains a list 1100 of those related elements. In the example of FIG. 11, "engine stop command issuance history" is used as the detection parameter, but a list 1100 of related elements can be obtained in the same way for other detection parameters (for example, "vehicle speed").

[0045] Return to the description of the operation. The graph generation unit 14 starts a loop process B that repeats the processes of steps S107 to S109 for each related element included in the list of related elements (step S106).

[0046] In loop process B, first, the graph generation unit 14 refers to the data flow related event template and system information to obtain an event template regarding an event that affects the target related element (step S107). The graph generation unit 14 adds information related to the related element (such as components and functions) according to the insertion part of the obtained event template to generate a node corresponding to the related element in the data flow dependent part of the causal relationship graph (step S108).

[0047] FIG. 12 is a diagram for explaining an example of the process of generating a node. As shown in FIG. 12, the graph generation unit 14 first uses the system information to identify the layer related to the target related element "communication relay function". The layer related to the target related element is the layer realized by the component corresponding to the related element. When the related element is a "function", it is "function", "OS", and "HW". When the related element is "data", it is "data", "OS", and "HW".

[0048] Subsequently, the graph generation unit 14 obtains from the data flow related event template DB112 an event template whose layer properties (command reception possibility, GUI operation possibility, and update possibility) related to the target related element "communication relay function" match the occurrence conditions. The graph generation unit 14 adds information related to the related element (such as components and functions) according to the insertion part of the obtained event template to generate a node 1201 corresponding to the related element in the data flow dependent part of the causal relationship graph.

[0049] Returning to the description of the operation, the graph generation unit 14 adds the generated node to the data flow independent part of the causal relationship graph (step S109).

[0050] FIG. 13 is a diagram for explaining an example of a process of adding a node to a data flow independent part. As shown in FIG. 13, the graph generation unit 14 generates a causal relationship graph 1300 by connecting a node 1201 of a data flow dependent part generated from detection parameters included in the development target node 1002 of the data flow independent part 1000 of the causal relationship graph to the development target node. Note that the logic gate connecting the nodes is OR (logical sum) in the example of FIG. 13, but is not limited to this example. For example, the logic gate connecting the nodes may be AND (logical product), or a combination of OR (logical sum) and AND (logical product).

[0051] Then, when the graph generation unit 14 executes the processes of steps S107 to S109 for all related elements, it ends the loop process B (step S110). Then, when the processes of steps S105 to S110 are executed for all target nodes, the loop process A is ended. Thereby, a causal relationship graph is generated.

[0052] Then, the input / output unit 10 outputs the generated causal relationship graph (step S112) and ends the process.

[0053] In the process described above, nodes of the data flow dependent part are added below the nodes of the data flow independent part of the causal relationship graph. However, the causal relationship graph is not limited to this example and may be a mixture of the data flow dependent part and the independent part. For example, nodes of the data flow independent part may be connected below the nodes of the data flow dependent part.

[0054] As described above, according to this embodiment, the related element extraction unit 13 identifies, based on detection parameters which are data used to detect incidents occurring in the system and a data flow indicating the flow of data used in the system, among the elements on the data flow, related elements which are elements affecting the detection parameters. The graph generation unit 14 identifies, based on the related elements identified by the related element extraction unit 13 and system information, related events which are events causing the incidents, and generates a causal relationship graph based on the related events. Therefore, since it is possible to generate a causal relationship graph based on the detection parameters and the data flow, it is possible to easily create a highly comprehensive causal relationship graph.

[0055] Also, in this embodiment, the graph generation unit 14 further identifies, based on event template information indicating, for each generation condition where an event occurs, an event template regarding an event occurring in relation to each element, events among the events occurring in the related elements that match the generation conditions as related events. For this reason, it becomes possible to more easily create a causal relationship graph.

[0056] Also, in this embodiment, the graph generation unit 14 inserts information related to the related element into the event template that matches the generation condition to identify the related event. For this reason, it becomes possible to more easily create a causal relationship graph.

[0057] Also, in this embodiment, the related element extraction unit 13 identifies related elements for each type of causal relationship graph. The graph generation unit 14 generates a causal relationship graph for each type of causal relationship graph. For this reason, it becomes possible to easily create various types of causal relationship graphs.

[0058] Also, in the present embodiment, the data flow independent part generation unit 12 generates an independent part that is a part independent of the data flow used in the system in the causal relationship graph based on the detection parameter and the type of incident. The graph generation unit 14 generates a causal relationship graph based on the related elements and the independent part. Therefore, it becomes possible to easily generate a causal relationship graph considering events independent of the data flow.

[0059] Also, in the present embodiment, the data flow independent part generation unit 12 inserts the detection parameter into the decomposition template corresponding to the type of incident to be the generation target of the causal relationship graph based on the decomposition template information indicating the decomposition template for the related events included in the independent part for each type of incident, and generates the data flow independent part. In this case, it becomes possible to easily create the data flow independent part of the causal relationship graph.

[0060] Also, in the present embodiment, the elements of the data flow include the functions of the system and the data used in the system. Therefore, it becomes possible to generate a more comprehensive causal relationship graph.

[0061] The above-described embodiments of the present disclosure are examples for explaining the present disclosure, and are not intended to limit the scope of the present disclosure only to those embodiments. A person skilled in the art can implement the present disclosure in various other modes without departing from the scope of the present disclosure.

Explanation of Reference Numerals

[0062] 1: Causal relationship graph generation device 10: Input / output unit 11: Storage unit 12: Data flow independent part generation unit 13: Related element extraction unit 14: Related event extraction unit

Claims

1. A causal relationship graph generation device that generates a causal relationship graph describing related events that are events causing an incident occurring in a system, a specifying unit that specifies, among elements on the data flow, related elements that are elements affecting the detection parameter, based on a detection parameter that is data used for detecting the occurrence of the incident and a data flow indicating a data flow used in the system; a graph generation unit that specifies the related events based on the related elements and system information indicating the configuration of the system, and generates the causal relationship graph based on the related events. A causal relationship graph generation device having these components.

2. The graph generation unit according to claim 1, wherein the graph generation unit specifies, as the related events, events that match the occurrence conditions among the events occurring in relation to the related elements, further based on event template information indicating event templates regarding events occurring in relation to each element for each occurrence condition where the event occurs.

3. The causal relationship graph generation device according to claim 2, wherein the graph generation unit inserts information related to the related element into the event template that matches the occurrence condition to specify the related events.

4. The specifying unit specifies the related elements for each type of the causal relationship graph, The graph generation unit according to claim 1, wherein the graph generation unit generates the causal relationship graph for each type.

5. further comprising a non-dependent part generation unit that generates a non-dependent part that is a part independent of the data flow used in the system in the causal relationship graph, based on the detection parameter and the type of the incident, The causal relationship graph generation device according to claim 1, wherein the graph generation unit generates the causal relationship graph based on the related elements and the non-dependent part.

6. The non-dependent part generation unit according to claim 5, wherein the non-dependent part generation unit inserts the detection parameter into the decomposition template corresponding to the type of the incident to be the generation target of the causal relationship graph, based on decomposition template information indicating decomposition templates regarding the related events included in the non-dependent part for each type of the incident, to generate the non-dependent part.

7. The causal relationship graph generation device according to claim 1, wherein the element includes a function of the system and data used in the system.

8. A causal relationship graph generation method by a causal relationship graph generation device that generates a causal relationship graph describing related events that are events causing an incident occurring in a system, Based on a detection parameter that is data used to detect the occurrence of the incident and a data flow indicating a data flow of data used in the system, among the elements on the data flow, identify related elements that are elements affecting the detection parameter, A causal relationship graph generation method for identifying the related event based on the related element and system information indicating the configuration of the system, and generating the causal relationship graph based on the related event.

Images